• A converted domain controller does not synchronize.
• The DNS services on a converter domain controller does not bind to the network interface.
• The local domain database file NTDS.DIT is corrupted in the new virtual machine.
• The domain controller becomes tombstoned in Active Directory and does not synchronize.
• Synchronization is unreliable with other domain controllers.
• Newly created or removed objects are changed on the virtual machine or source reappear in Active Directory.
• The update or serial number changes unexpectedly on the domain controller.
• Kerberos authentication or trust failures.
• DNS lookup failures.
• You see these errors:
  
  LSASS.EXE - System Error, security accounts manager initialization failed because of the following error: Directory Services cannot start. Error status 0xc00002e1.
  Event ID: 1103
  Description: "The windows directory services database could not be initialized and returned error 1032. Unrecoverable error, the directory can't continue."
  Event ID 2042: It has been too long since this machine last replicated with the named source machine. The time between replications with this source has exceeded the tombstone lifetime. Replication has been stopped with this source.

Introduction

Windows 2000, 2003, 2008, and 2012 Servers

• Decommission the existing domain controller using dcpromo, and provision a new domain controller during the installation of new Windows Server in a new virtual machine. Do not perform the conversion, but use the source server's host name and IP address. (recommended)
• Ensure another domain controller is online on the network and properly synchronized. If one is not available, provision a new domain controller as a virtual machine and promote it. Demote the domain controller using dcpromo. Set any static IP addresses to DHCP prior to conversion. When converted power off the source server, reassign static IP address, and promote the virtualized server.
  
  Notes:
  • Always start using the new virtual machine as soon as possible after decommissioning the physical or source server. Failure to do so leads to a tombstone condition.
  • Never use the customization option in the Conversion Wizard. Using this process destroys the server on the destination.
  • Ensure that the source server is powered off or decommissioned before starting the new virtual machine with the network cards connected.
  • If the server to be virtualized holds any FSMO roles, transfer the roles to an existing and running domain controller. If a problem happens during the conversion process, you can provision new domain controllers in Active Directory and perform other AD operations without having to seize roles from the unavailable domain controller. For more information on FSMO roles in Windows Server 2003, see the Microsoft Knowledge Base article 324801.
  • For current Windows Server 2003 Active Directory domains with one Windows Server 2008 R2 domain controller, validate the domain/forest functionality by running the dcdiag /c /v /e command. Before beginning, run the repadmin and showreps commands to check for errors.
  • Avoid converting Windows NT domain controllers, if possible.
  • Before attempting conversion, always be sure another domain controller is online and properly synchronized.
  • Always ensure that the source server is powered off or decommissioned before starting the new virtual machine with the network cards connected.
     
• Do not perform ONLINE physical-to-virtual (P2V) conversions. For more information, see Microsoft Technet Blog Article: How to Virtualize Active Directory Domain Controllers (Part 1).